Linux Version of Chrome Ships with New Sandbox

The sandboxing system implemented in Google`s Chrome browser has undergone a major overhaul in development version 23.0.1255.0 with the introduction of a brand new sandbox on Linux and ChromeOS for renderers.

The new sandbox uses a feature called Seccomp-BPF that gives the Linux kernel a higher degree of control in imposing restrictions to the application, as well as to evaluate system call numbers and their parameters. This approach will likely result not only in performance improvements, but will allow the kernel to detect logic traps such as code that makes it loop endlessly until it depletes the system`s resources.

Image credits: Google Chrome

The use of seccomp-BPF is believed to dramatically reduce the attack surface of the operating system kernel. “This is a huge change for sandboxing code in Linux, which, as you may recall, has been very limited in this area. It’s also a change that recognizes and innovates in two important dimensions of sandboxing […]“ wrote Google Security Software Engineer Julien Tinnes in a blog post.

For now, Linux versions of the most popular browsers have been relatively safe from security incidents similar to the attacks against Java, Reader or Flash plugins, but, as cyber-threats become cross-platform, the manufacturers are becoming more and more concerned with unknown, zero-day attacks carried out through the browser.